Welcome!

Cloud Security Authors: Elizabeth White, Liz McMillan, Pat Romanski, Mamoon Yunus, Lisa Calkins

Related Topics: @CloudExpo, Java IoT, Microservices Expo, Containers Expo Blog, Agile Computing, Cloud Security

@CloudExpo: Article

Software as a Service (SaaS), Security and Risk Management: Part 1

A SaaS Security roadmap

As cloud computing technologies and offerings mature and evolve in its services to customers, one common consumer use will be that of the Software as a Service (SaaS) model.

My earlier articles have touched on the various models, risks, security and forensics at several levels. There is also a plethora of resources available now that end users can educate themselves with that are freely available online.

This article will focus on aspects of security that impact the SaaS environment as developed, presented or augmented by me for several Cloud Computing projects.

Before we proceed in the subject matter, a brief clarification of what I refer to as the cloud follows. Keep in mind that this term "cloud computing" is now being used to describe a broad range of services to include product descriptors that sits outside the common definition of the cloud.

For ease of reference I will refer to the National Institute of Standards and Technology (NIST) [1] definition of which the following is a part. "Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction."

Over the years since the concept of Cloud Computing evolved we have seen an accepted concept of the "Cloud Computing Stack", with its three distinct categories: Software as a Service, Platform as a Service and Infrastructure as a Service; where the IaaS Is the platform upon which PaaS rests and which is turn has SaaS rests moving up from IaaS to SaaS.

It is important to keep this basic stack in mind as the building blocks of the Cloud Computing system and not get distracted by all the "as a Service" spring up across markets as we proceed with this article.

As we move more and more services into the Cloud ecosystem, there will always be concerns regarding security. However a prescriptive combination of both preventive and detective controls at those data centers housing the IaaS ecosystem is on the path to security compliance and event mitigation. These controls, as a step toward better cloud computing security should be assessed and assured to meet industry tested security controls, as well as regulatory and policy requirements. The same format can be modified and applied up the stack to the PaaS segment.

However it is at the SaaS layer that we can perceive additional challenges with cloud security. One critical area of concern stems from the potential risk that a client's data can be exposed to as it is stored within the storage system of its SaaS provider. This risk can potentially increase in the event of the SaaS provider in turn utilizing the services of a third party IaaS provider.

While effective data center security controls are good for inside a data center, web-services or applications outside this area are a growing target for application layer type attacks. This can lead to the loss of critical to sensitive customer data as well as intellectual property and other corporate data.

A challenge for the IT security professional here is how to implement a level of protection that meets IT Security control requirements as well as ensures compliance with information security regulations, E.g. PCI-DSS in the case of transactions via web services.

In both the traditional environments and cloud services infrastructure environments, we have firewalls tweaked and configured with rulebase automation as a best practice. However in the dynamic cloud environment I believe that having to manage firewall signatures for example, amongst other issues could be challenging and counter-productive.

Essentially we would need to implement security in a layered approach which should include the network, servers, databases and coding, augmented by a system that should have a defined security process based on the SaaS environment and its functionality. This should be an additive measure to augment other monitoring and logging systems deployed to secure this environment.

This system should also have the ability to implement tools that will be able to dynamically learn the behavior of an application supported by an automated mechanism, thus removing the need for signatures in the case of firewall systems as mentioned earlier.

Within the SaaS environment we need to ensure adequate security in input validation by SaaS end users, effective user authentication and authorization, proper data segregation with security encapsulation for data in motion using SSL (3.0 or above) or TLS (1.0 above), effective software patching policies and procedures by the SaaS provider working with its software vendors as well as a key generation strategy.

(While SSL/TLS is encryption for data in motion between a Web Server and a browser is a good practice, administrators should disable weak algorithms and ciphers residing on the Web Server).

There must also be assurance for uptime or availability that is formalized in a Service Level Agreement (SLA). Impact on environments supporting the SaaS ecosystem can be attacks impacting Network Security as well as the process for Backup and Recovery.

Researchers Bhadauria and Sanyal [1] stated "Two types of servers are used by SaaS: the Main Consistence Server (MCS) and Domain Consistence Server (DCS). Cache coherence is achieved by the cooperation between MCS and DCS. In SaaS, if the MCS is damaged, or compromised, the control over the cloud environment is lost. Hence securing the MCS is of great importance."

Another concern within this ecosystem is that of cross site scripting attacks that targets Asynchronous JavaScript and XML- AJAX [2].A best practice here would be to have a policy that ensures that all calls are verified with the Web Server and Service to ensure proper authentication and authorization before allowing the request.

Moving away a bit from the technology of security in this environment, Cloud Computing and SaaS on a whole was in its infancy and in some circles denounced as a viable IT service (no names called here, but a tech company leader specializing in databases and now cloud products comes to mind).

In terms of regulations that impact web services and by extension SaaS, we can reference the Gramm-Leach-Bliley Act (GLBA) [3] passed in 1999, Sarbanes-Oxley Act (SOX) in 2002 [4], and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule of 2003[5]. All three of these regulations, although important in their relative environments (e.g. Customer Relationship Management (CRM), Enterprise Resource Planning (ERP), Intellectual Property systems (IPS) and Human Resources Systems), were not crafted to include elements of a SaaS environment then.

As a result there needs to be finite and focused addendums or improvement to these acts as was in the case of SAS 70 to SSAE 16 to meet this technological evolution.

Of importance is that, despite the security measures and attestations provided by a SaaS provider to assure a client of their security controls or compensating controls and compliance processes in place to meet regulatory and security standards; it is still the responsibility of a data owner to maintain industry regulated requirements to comply with confidentiality, integrity, non-repudiation and security control over sensitive to critical information.

So the challenge here is to ensure that a cloud client requirement (Security Policy, Strategy, Data Provenance, Operational and End-User Security) is part of the discussion with the cloud provider and most if not all requirements mirror.

The designation of data classification is part of another topic and should be the influenced by the result of risk impact and gap analysis.

As a closing point the value of vulnerability assessments and penetration tests within the SaaS environment is an important tool for an independent set of eyes to present information that a potential attacker will find and use against the SaaS. This is not only related to technology as is well known due to the rise of social engineering.

References

[1] A Survey on Security Issues in Cloud Computing www.ijcaonline.org › Archives › Volume 47 › Number 18, Rohit Bhadauria; Sugata Sanyal, 2012

[2] Jesse James Garrett (18 February 2005). "Ajax: A New Approach to Web Applications". AdaptivePath.com.

[3] http://business.ftc.gov/privacy-and-security/gramm-leach-bliley-act

[4] http://www.sec.gov/info/smallbus/404guide/intro.shtml

[5] http://www.hhs.gov/ocr/privacy/

More Stories By Jon Shende

Jon RG Shende is an executive with over 18 years of industry experience. He commenced his career, in the medical arena, then moved into the Oil and Gas environment where he was introduced to SCADA and network technologies,also becoming certified in Industrial Pump and Valve repairs. Jon gained global experience over his career working within several verticals to include pharma, medical sales and marketing services as well as within the technology services environment, eventually becoming the youngest VP of an international enterprise. He is a graduate of the University of Oxford, holds a Masters certificate in Business Administration, as well as an MSc in IT Security, specializing in Computer Crime and Forensics with a thesis on security in the Cloud. Jon, well versed with the technology startup and mid sized venture ecosystems, has contributed at the C and Senior Director level for former clients. As an IT Security Executive, Jon has experience with Virtualization,Strategy, Governance,Risk Management, Continuity and Compliance. He was an early adopter of web-services, web-based tools and successfully beta tested a remote assistance and support software for a major telecom. Within the realm of sales, marketing and business development, Jon earned commendations for turnaround strategies within the services and pharma industry. For one pharma contract he was responsibe for bringing low performing districts up to number 1 rankings for consecutive quarters; as well as outperforming quotas from 125% up to 314%. Part of this was achieved by working closely with sales and marketing teams to ensure message and product placement were on point. Professionally he is a Fellow of the BCS Chartered Institute for IT, an HITRUST Certified CSF Practitioner and holds the CITP and CRISC certifications.Jon Shende currently works as a Senior Director for a CSP. A recognised thought Leader, Jon has been invited to speak for the SANs Institute, has spoken at Cloud Expo in New York as well as sat on a panel at Cloud Expo Santa Clara, and has been an Ernst and Young CPE conference speaker. His personal blog is located at http://jonshende.blogspot.com/view/magazine "We are what we repeatedly do. Excellence, therefore, is not an act, but a habit."

@ThingsExpo Stories
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. Jack Norris reviews best practices to show how companies develop, deploy, and dynamically update these applications and how this data-first...
Intelligent Automation is now one of the key business imperatives for CIOs and CISOs impacting all areas of business today. In his session at 21st Cloud Expo, Brian Boeggeman, VP Alliances & Partnerships at Ayehu, will talk about how business value is created and delivered through intelligent automation to today’s enterprises. The open ecosystem platform approach toward Intelligent Automation that Ayehu delivers to the market is core to enabling the creation of the self-driving enterprise.
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
The question before companies today is not whether to become intelligent, it’s a question of how and how fast. The key is to adopt and deploy an intelligent application strategy while simultaneously preparing to scale that intelligence. In her session at 21st Cloud Expo, Sangeeta Chakraborty, Chief Customer Officer at Ayasdi, will provide a tactical framework to become a truly intelligent enterprise, including how to identify the right applications for AI, how to build a Center of Excellence to ...
SYS-CON Events announced today that Massive Networks will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Massive Networks mission is simple. To help your business operate seamlessly with fast, reliable, and secure internet and network solutions. Improve your customer's experience with outstanding connections to your cloud.
Everything run by electricity will eventually be connected to the Internet. Get ahead of the Internet of Things revolution and join Akvelon expert and IoT industry leader, Sergey Grebnov, in his session at @ThingsExpo, for an educational dive into the world of managing your home, workplace and all the devices they contain with the power of machine-based AI and intelligent Bot services for a completely streamlined experience.
Because IoT devices are deployed in mission-critical environments more than ever before, it’s increasingly imperative they be truly smart. IoT sensors simply stockpiling data isn’t useful. IoT must be artificially and naturally intelligent in order to provide more value In his session at @ThingsExpo, John Crupi, Vice President and Engineering System Architect at Greenwave Systems, will discuss how IoT artificial intelligence (AI) can be carried out via edge analytics and machine learning techn...
SYS-CON Events announced today that Datera, that offers a radically new data management architecture, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera is transforming the traditional datacenter model through modern cloud simplicity. The technology industry is at another major inflection point. The rise of mobile, the Internet of Things, data storage and Big...
Consumers increasingly expect their electronic "things" to be connected to smart phones, tablets and the Internet. When that thing happens to be a medical device, the risks and benefits of connectivity must be carefully weighed. Once the decision is made that connecting the device is beneficial, medical device manufacturers must design their products to maintain patient safety and prevent compromised personal health information in the face of cybersecurity threats. In his session at @ThingsExpo...
In his session at @ThingsExpo, Arvind Radhakrishnen discussed how IoT offers new business models in banking and financial services organizations with the capability to revolutionize products, payments, channels, business processes and asset management built on strong architectural foundation. The following topics were covered: How IoT stands to impact various business parameters including customer experience, cost and risk management within BFS organizations.
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business - from apparel to energy - is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
From 2013, NTT Communications has been providing cPaaS service, SkyWay. Its customer’s expectations for leveraging WebRTC technology are not only typical real-time communication use cases such as Web conference, remote education, but also IoT use cases such as remote camera monitoring, smart-glass, and robotic. Because of this, NTT Communications has numerous IoT business use-cases that its customers are developing on top of PaaS. WebRTC will lead IoT businesses to be more innovative and address...
An increasing number of companies are creating products that combine data with analytical capabilities. Running interactive queries on Big Data requires complex architectures to store and query data effectively, typically involving data streams, an choosing efficient file format/database and multiple independent systems that are tied together through custom-engineered pipelines. In his session at @BigDataExpo at @ThingsExpo, Tomer Levi, a senior software engineer at Intel’s Advanced Analytics ...
SYS-CON Events announced today that App2Cloud will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. App2Cloud is an online Platform, specializing in migrating legacy applications to any Cloud Providers (AWS, Azure, Google Cloud).
Recently, IoT seems emerging as a solution vehicle for data analytics on real-world scenarios from setting a room temperature setting to predicting a component failure of an aircraft. Compared with developing an application or deploying a cloud service, is an IoT solution unique? If so, how? How does a typical IoT solution architecture consist? And what are the essential components and how are they relevant to each other? How does the security play out? What are the best practices in formulating...
SYS-CON Events announced today that MobiDev, a client-oriented software development company, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex software systems for startups and enterprises. Since 2009 it has grown from a small group of passionate engineers and business...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
SYS-CON Events announced today that Dasher Technologies will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Dasher Technologies, Inc. ® is a premier IT solution provider that delivers expert technical resources along with trusted account executives to architect and deliver complete IT solutions and services to help our clients execute their goals, plans and objectives. Since 1999, we'v...
SYS-CON Events announced today that Ayehu will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Ayehu provides IT Process Automation & Orchestration solutions for IT and Security professionals to identify and resolve critical incidents and enable rapid containment, eradication, and recovery from cyber security breaches. Ayehu provides customers greater control over IT infrastructure throu...
SYS-CON Events announced today that Grape Up will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company specializing in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the U.S. and Europe, Grape Up works with a variety of customers from emergi...